Hovatek Forum MOBILE Android [Tutorial] How to bypass verified boot is enabled error in SP flash tool
Can't login? Please, reset your password.
Hovatek is recruiting! Apply Now


[Tutorial] How to bypass verified boot is enabled error in SP flash tool

[Tutorial] How to bypass verified boot is enabled error in SP flash tool

Pages (2): 1 2 Next
hovatek
hovatek
hovatek
Administrator
49,570
04-06-2021, 10:19 AM
#1



This guide will explain how to bypass the "Verified boot is enabled" error in SP flash tool. You'll usually encounter this error when trying to flash to protected partitions (common in Secure Boot devices ).

The error is usually like:
Code:

Verified boot is enabled
Please, download signed image (*-verified.img) or disable verified boot

Where * is the partition name. It could be rct, md1, vbmeta, system, laf, opporeserve etc depending on your device.

The principle of this technique is to merge the contents of the file you are trying to flash to a particular partition (but are not allowed) into the file meant for a neighbouring partition that you are allowed to flash. In the end, you deliver the payload, only that it's disguised as you flashing another partition.

The fact that you're getting this error means you already have some knowledge of SP flash tool so we won't be dwelling on the flashing process itself.

Requirements


Steps to bypass verified boot is enabled error in SP flash tool


Follow the steps below to flash to partitions that require -verified files


See the video below or @ https://youtu.be/ELXYLP17aUs


  1. Open the pgpt file in hexeditor

    [Image: How-to-bypass-verified-boot-is-enabled-e...ool-1.webp]

  2. Scroll down gradually to where the last partition appears. You can monitor from the strings section on the right. Everything after the last partition will be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 . Place your mouse cursor at the end of the row of the last partition (in the Hex section) or just highlight the first row of zeros

    [Image: How-to-bypass-verified-boot-is-enabled-e...ool-2.webp]

  3. At the top of HxD, click Search > Replace

    [Image: How-to-bypass-verified-boot-is-enabled-e...ool-3.webp]

  4. Click the Hex-values tab

    [Image: How-to-bypass-verified-boot-is-enabled-e...ool-4.webp]

  5. Paste 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 in Search for field, leave Replace with blank, set Search direction to Forward then click Replace all. Click OK if asked to confirm anything

    [Image: How-to-bypass-verified-boot-is-enabled-e...ool-5.webp]

  6. Wait while HxD removes all the trailing 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 after the last row

    [Image: How-to-bypass-verified-boot-is-enabled-e...ool-6.webp]

  7. Save the pgpt file

    [Image: How-to-bypass-verified-boot-is-enabled-e...ool-7.webp]

  8. Open the scatter file using your preferred notepad app

  9. A scatter file looks something like this:

    Code:

    #########################################__WwR_MTK_2.50__###################################################
    #
    #  General Setting
    #
    #########################################__WwR_MTK_2.50__###################################################
    - general: MTK_PLATFORM_CFG
      info:
        - config_version: V1.1.2
          platform: MT6765
          project: muse6765_64_dh50_q
          storage: EMMC
          boot_channel: MSDC_0
          block_size: 0x20000
    ############################################################################################################
    #
    #  Layout Setting
    #
    ############################################################################################################
    - partition_index: SYS0
      partition_name: preloader
      file_name: preloader_muse6765_64_dh50_q.bin
      is_download: true
      type: SV5_BL_BIN
      linear_start_addr: 0x0
      physical_start_addr: 0x0
      partition_size: 0x40000
      region: EMMC_BOOT_1
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: BOOTLOADERS
      is_upgradable: true
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS1
      partition_name: pgpt
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x0
      physical_start_addr: 0x0
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS2
      partition_name: boot_para
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x800000
      physical_start_addr: 0x800000
      partition_size: 0x100000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS3
      partition_name: proinfo
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x900000
      physical_start_addr: 0x900000
      partition_size: 0x300000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: PROTECTED
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS4
      partition_name: para
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xC00000
      physical_start_addr: 0xC00000
      partition_size: 0x80000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS5
      partition_name: efuse
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xC80000
      physical_start_addr: 0xC80000
      partition_size: 0x80000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS6
      partition_name: spare1
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xD00000
      physical_start_addr: 0xD00000
      partition_size: 0x300000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS7
      partition_name: nvcfg
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x1000000
      physical_start_addr: 0x1000000
      partition_size: 0x2000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: PROTECTED
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS8
      partition_name: nvdata
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x3000000
      physical_start_addr: 0x3000000
      partition_size: 0x4000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS9
      partition_name: metadata
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x7000000
      physical_start_addr: 0x7000000
      partition_size: 0x2000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS10
      partition_name: misc2
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x9000000
      physical_start_addr: 0x9000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS11
      partition_name: ftm
      file_name: ftm.img_311296
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x9800000
      physical_start_addr: 0x9800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS12
      partition_name: md_udc
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xA000000
      physical_start_addr: 0xA000000
      partition_size: 0x1800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS13
      partition_name: expdb
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xB800000
      physical_start_addr: 0xB800000
      partition_size: 0x1800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS14
      partition_name: frp
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xD000000
      physical_start_addr: 0xD000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS15
      partition_name: protect1
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xD800000
      physical_start_addr: 0xD800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: PROTECTED
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS16
      partition_name: protect2
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xE000000
      physical_start_addr: 0xE000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: PROTECTED
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS17
      partition_name: seccfg
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xE800000
      physical_start_addr: 0xE800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS18
      partition_name: nvram
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xF000000
      physical_start_addr: 0xF000000
      partition_size: 0x4000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: BINREGION
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS19
      partition_name: persist
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x13000000
      physical_start_addr: 0x13000000
      partition_size: 0x3000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: PROTECTED
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS20
      partition_name: persist_lg
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x16000000
      physical_start_addr: 0x16000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS21
      partition_name: p_persist_lg
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x16800000
      physical_start_addr: 0x16800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS22
      partition_name: md1img_a
      file_name: md1img.img_753664
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x17000000
      physical_start_addr: 0x17000000
      partition_size: 0x6000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: UPDATE
      is_upgradable: true
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS23
      partition_name: spmfw_a
      file_name: spmfw.img_950272
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x1D000000
      physical_start_addr: 0x1D000000
      partition_size: 0x100000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: UPDATE
      is_upgradable: true
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS24
      partition_name: scp_a
      file_name: scp.img_952320
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x1D100000
      physical_start_addr: 0x1D100000
      partition_size: 0x100000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS25
      partition_name: sspm_a
      file_name: sspm.img_954368
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x1D200000
      physical_start_addr: 0x1D200000
      partition_size: 0x100000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: UPDATE
      is_upgradable: true
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS26
      partition_name: lk_a
      file_name: lk.img_956416
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x1D300000
      physical_start_addr: 0x1D300000
      partition_size: 0x200000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: UPDATE
      is_upgradable: true
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS27
      partition_name: tee_a
      file_name: tee.img_960512
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x1D500000
      physical_start_addr: 0x1D500000
      partition_size: 0x500000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: UPDATE
      is_upgradable: true
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS28
      partition_name: spare2
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x1DA00000
      physical_start_addr: 0x1DA00000
      partition_size: 0x600000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS29
      partition_name: logo_a
      file_name: logo.bin_983040
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x1E000000
      physical_start_addr: 0x1E000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS30
      partition_name: dtbo_a
      file_name: dtbo.img_999424
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x1E800000
      physical_start_addr: 0x1E800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS31
      partition_name: vbmeta_a
      file_name: vbmeta_NA5_US.img_1015808
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x1F000000
      physical_start_addr: 0x1F000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS32
      partition_name: vbmeta_system_a
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x1F800000
      physical_start_addr: 0x1F800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS33
      partition_name: vbmeta_vendor_a
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x20000000
      physical_start_addr: 0x20000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS34
      partition_name: boot_a
      file_name: boot.img_1064960
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x20800000
      physical_start_addr: 0x20800000
      partition_size: 0x2800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: UPDATE
      is_upgradable: true
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS35
      partition_name: laf_a
      file_name: laf.img_1146880
      is_download: true
      type: NORMAL_ROM
      linear_start_addr: 0x23000000
      physical_start_addr: 0x23000000
      partition_size: 0x2800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS36
      partition_name: md1img_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x25800000
      physical_start_addr: 0x25800000
      partition_size: 0x6000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS37
      partition_name: spmfw_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2B800000
      physical_start_addr: 0x2B800000
      partition_size: 0x100000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS38
      partition_name: scp_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2B900000
      physical_start_addr: 0x2B900000
      partition_size: 0x100000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS39
      partition_name: sspm_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2BA00000
      physical_start_addr: 0x2BA00000
      partition_size: 0x100000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS40
      partition_name: lk_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2BB00000
      physical_start_addr: 0x2BB00000
      partition_size: 0x200000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS41
      partition_name: tee_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2BD00000
      physical_start_addr: 0x2BD00000
      partition_size: 0x500000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS42
      partition_name: spare3
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2C200000
      physical_start_addr: 0x2C200000
      partition_size: 0x600000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS43
      partition_name: logo_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2C800000
      physical_start_addr: 0x2C800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS44
      partition_name: dtbo_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2D000000
      physical_start_addr: 0x2D000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS45
      partition_name: vbmeta_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2D800000
      physical_start_addr: 0x2D800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS46
      partition_name: vbmeta_system_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2E000000
      physical_start_addr: 0x2E000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS47
      partition_name: vbmeta_vendor_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2E800000
      physical_start_addr: 0x2E800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS48
      partition_name: boot_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x2F000000
      physical_start_addr: 0x2F000000
      partition_size: 0x2800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS49
      partition_name: laf_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x31800000
      physical_start_addr: 0x31800000
      partition_size: 0x2800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS50
      partition_name: eksst
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x34000000
      physical_start_addr: 0x34000000
      partition_size: 0x80000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS51
      partition_name: encrypt
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x34080000
      physical_start_addr: 0x34080000
      partition_size: 0x80000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS52
      partition_name: rct
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x34100000
      physical_start_addr: 0x34100000
      partition_size: 0x100000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS53
      partition_name: spare4
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x34200000
      physical_start_addr: 0x34200000
      partition_size: 0x600000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS54
      partition_name: power
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x34800000
      physical_start_addr: 0x34800000
      partition_size: 0x2800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS55
      partition_name: mpt
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x37000000
      physical_start_addr: 0x37000000
      partition_size: 0x2000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS56
      partition_name: fota
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x39000000
      physical_start_addr: 0x39000000
      partition_size: 0x1000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS57
      partition_name: els
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x3A000000
      physical_start_addr: 0x3A000000
      partition_size: 0x1000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS58
      partition_name: carrier
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x3B000000
      physical_start_addr: 0x3B000000
      partition_size: 0x3800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS59
      partition_name: srtc
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x3E800000
      physical_start_addr: 0x3E800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS60
      partition_name: eri
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x3F000000
      physical_start_addr: 0x3F000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS61
      partition_name: operatorlogging
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x3F800000
      physical_start_addr: 0x3F800000
      partition_size: 0x1000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS62
      partition_name: super
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x40800000
      physical_start_addr: 0x40800000
      partition_size: 0x2EF000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS63
      partition_name: OP_a
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x32F800000
      physical_start_addr: 0x32F800000
      partition_size: 0xC0000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS64
      partition_name: OP_b
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x3EF800000
      physical_start_addr: 0x3EF800000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: INVISIBLE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS65
      partition_name: userdata
      file_name: userdata.img
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x3F0000000
      physical_start_addr: 0x3F0000000
      partition_size: 0xA9E000000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: true
      is_reserved: false
      operation_type: UPDATE
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS66
      partition_name: flashinfo
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0x1FFFE010800
      physical_start_addr: 0x1FFFE010800
      partition_size: 0x0
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: false
      is_reserved: true
      operation_type: RESERVED
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

    - partition_index: SYS67
      partition_name: sgpt
      file_name: NONE
      is_download: false
      type: NORMAL_ROM
      linear_start_addr: 0xE8F000000
      physical_start_addr: 0xE8F000000
      partition_size: 0x800000
      region: EMMC_USER
      storage: HW_STORAGE_EMMC
      boundary_check: false
      is_reserved: true
      operation_type: RESERVED
      is_upgradable: false
      empty_boot_needed: false
      reserve: 0x00

  10. For this example, I'll assume laf_a is giving the -verified error but I can flash boot_a which is just above laf_a in the scatter file.

  11. For reference the addresses are
    Code:

    boot_a
    physical_start_addr: 0x20800000
    partition_size: 0x2800000

    laf_a
    physical_start_addr: 0x23000000
    partition_size: 0x2800000

  12. Using the Hex calculator, you add the partition size for laf (which is 2800000 because you remove the 0x part) and add it to the partition size for boot_a which is also 2800000. Now with the Hex calculator, 2800000 + 2800000 = 5000000

  13. You then change the partition size for boot_a from 0x2800000 to 0x5000000 and remove the laf_a section from the scatter file.

  14. Save the scatter file then go back to HxD

  15. In HxD, open the boot.img_1064960 file (obtained from file_name: in the boot_a section of the scatter file) and laf.img_1146880 (file name from laf_a section)

    [Image: How-to-bypass-verified-boot-is-enabled-e...ool-8.webp]

  16. Select all and copy the Hex contents of laf.img_1146880 then scroll to the bottom of boot.img_1064960 and paste. This is basically appending laf.img_1146880 to the bottom of boot.img_1064960

    [Image: How-to-bypass-verified-boot-is-enabled-e...ool-9.webp]

  17. Save the boot.img_1064960 (the size should have increased)

  18. Re-load the scatter file in SP flash tool (Laf_a should no longer be on the list)

    [Image: How-to-bypass-verified-boot-is-enabled-e...ol-10.webp]

  19. Flash using format all + download

    [Image: How-to-bypass-verified-boot-is-enabled-e...ol-11.webp]

  20. Go back to the scatter file in notepad and change is_download: false to is_download: true for pgpt. Ensure to change file name from NONE to the file name of your pgpt. Save and reload the scatter file in SP flash tool. PGPT should now appear on the list in SP flash tool

  21. Flash only pgpt using download only

    [Image: How-to-bypass-verified-boot-is-enabled-e...ol-12.webp]

  22. Now, you can boot up the device as the -verified partiton has now been flashed to



Important Notice
  • This technique can be used to flash multiple consecutive partitons (as they appear in the scatter file), you just need to add all their partition sizes to that of the top flashable partition then remove them from the scatter file
  • To use format all + download, all diplayed partitions must have files attached to them so hide any you don't have a file for by setting is_download: false for that partition in the scatter file
  • Some models require preloader to be ticked and loaded for all operations in SP flash tool
  • You can find fixes to other SP flash errors at our SP flash tool errors and solutions thread

Video Transcript
Quote:In this video tutorial, I'll be explaining how to bypass verified boot is enabled in SP flash tool. You'll usually get this error when you're trying to flash maybe some secure boot devices and it looks something like this although the error code could be different; You have verified boot is enabled please download signed image your partition-verified.img or disable verified boot. So you're getting this error because you're trying to flash to a restricted partition. Now, some fixes that you could try are to use the latest version of sp flash tool, to try using format all + download but only do this when you have the auth file or you're using the mtk auth bypass. You could also consider skipping that partition all together if its not that important you can ignore the partition and flash the others. When these particular fixes don't work, this is one approach you should consider. Now you're going to need the firmware for your device, preferably a factory or signed firmware, you'll need the pgpt. If your firmware doesn't come with one then you can generate one using wwr.

I'll link to a guide on wwr backup then you're going to need of course sp lash tool, your drivers and every other thing you would need for an sp flash tool flash. Of course you're going to need hex editor, make sure you download that one, I'll link to that and then an online Hex calculator. we'll be using this website, I'll attach the link also. Alright, so we have everything we need in place and of course your notepad whether notepad++ or regular notepad. Now, lets assume I'm trying to flash.... I'm going to load a scatter file here, I'm loading the scatter file. Lets say I'm trying to flash these files for example, laf (this s an lg scatter file). Laf keeps giving me error. Now, laf helps you enter download mode on LG devices. Lets say I really need to flash laf but it just keeps giving me that verified error. What I could do is to use this trick to flash to the laf partition. Now first off, you need to open the scatter file. You have that from your firmware so I'll open the scatter file for this particular firmware. I'll do that with notepad++. Now, I'll locate the laf.. the laf_a to be precise because this is an aboot device.. AB device rather. So laf_a, this is the partition I'm trying to flash that just wouldn't flash. So you look just above that partition, here I have boot_a just above it because a scatter file is linearly arranged, a scatter file is just like a map of all the partitions on your device, where they start and where they stop so that flash tools can easily locate them and know where to write their respective files. That's what the scatter file is, its just like a map. So, in this scatter file, everything is arranged linearly as they appear so boot_a comes just above laf_a. Now, because I can flash boot_a in sp flash tool but I can't flash laf_a, I'm going to use this trick.

Now first off, you need to get the address for boot_a alright so lets say this is here alright I have the partition .. I have the start address and I have the partition size. So I get the partition size for boot_a. You're going to ignore the 0x part, you don't need that for the hex calculation so I paste that here then I'm going to get the size for laf_a, the partition size also copy. I'm adding then calculate. Alright, so this is the value. So you copy this and you come back under boot_a and then you change the partition size size to the sum alright and then you can delete the laf partition. Remember its just one space so here it is. Now you save. Now the next thing, you open hex editor, I'm using HxD. First you're going to prepare the pgpt for flashing. Usually, the pgpt you have would be 512 kilobytes.. let me.. or maybe even larger. Something like this, this is much larger. So what we want to do is reduce the size to allow flashing so first we load the pgpt here in hex editor. Now you scroll gradually till you get to the last partition you can look under the decoded text field. You can see I have content all through here. Alright, so content seems to have ended here. Alright, now we want to get rid of all the zeros after the content so you select this row of zeros, you copy, now you click on Search - Replace, come under Hex values, paste the zeros, you leave Replace with blank, set Search direction to forward and then you click Replace all. Click OK.

You just wait while it replaces all those zeros. What we're trying to do here is just reduce the size of pgpt to allow flashing . Alright, so that is done. Now you can save the pgpt alright, you save it. Now, the next step, you're going to append the laf image.. now from the scatter file, you can see that.. I'll just Ctrl + Z a little.. from the scatter file, you can see that laf is this particular file, you can locate it here and boot is this particular file, under file name, we can locate it here, alright, so I'll append this file, laf file to the boot in hex editor. So first I open the boot then I open the laf. So because boot comes before laf in the scatter file, I will select all the content of laf under the hex and I'll copy then come to boot scroll down to the very bottom of boot and then you can highlight somewhere here and then you Ctrl + V, you paste, click OK to confirm. So now you see that has appended laf to boot so you save. Now lets look at the file size before. You can see the file size before, around 40 Megabytes so when we save, we will now have something larger. Alright, so you can see its now larger. Now you are ready to load the scatter file in sp flash tool. We have our patched pgpt reduced in size, everything seems ok here. Now back to SP flash tool, you can see how this is loaded, this is before any modification, you can see I have laf, I have boot showing just fine. So now I've updated the scatter file and the (other) files so I'm going to reload the scatter file. Now if you did everything correctly, you should see that laf is no longer on the list, all you should now have is boot, a much larger boot. Now with all the other files of course loaded. You're going to flash this selection using format all + download. Now some devices require that you have preloader for you to flash them, some don't, you just take note of that if yours does.

When doing format all, you need to have files assigned for any ticked partition. Any partition that appears on this list needs to have a file attached to it. If you don't have a file for a partition appearing here, you can just set is_download to false for that partition in your scatter file, just locate the partition in your scatter file, set is_download from true to false then you save and reload the scatter file, that should remove it from this list. So everything on this list should have a file under location here attached to it then you do format all + download. Now, when this is done, after doing format + download and it is done, you come back to.. I'll not be doing this because I assume you already have (know) the basics of SP flash tool alright? So you come back to pgpt. Now you set is_download to true and ten you grab the file name for pgpt, this is it right here. You can see its gone from about 8 Megabytes to like 10 Kilobytes so this will allow flashing and then under the scatter file, you set file name from NONE to this and then you save. Now notice that pgpt wasn't on the list during this first flash alright? So now you reload the scatter file and pgpt should now appear on the list. Now we have it. So what you do now is to untick every other item and you flash just pgpt using download only but some devices -as I said- require you to flash preloader also so you might need to tick preloader also for some devices, not necessarily all then you flash the pgpt. You can do a readback if you want to, you can decide to boot up but by the time you've done this second flash, you will see that the partition which had verified has now been flashed to. So that's how to bypass verified boot is enabled on a Mediatek Android device
This post was last modified: 09-11-2023, 07:48 PM by hovatek.

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
babttech
babttech
babttech
Junior Member
15
06-11-2021, 11:06 PM
#2
pls help I followed all the the steps but when format all and download it move to next partition.... like it started with vbmeta_system signed then I appended it to the up partition then it changed to vbmeta_vendor signed and I did the the same process it become 3partition in one I tried flash with sptool then I see super -verified. Img(error status_sec_img_too_large(0xC0020005)
Please what can i do
This post was last modified: 06-11-2021, 11:15 PM by babttech.
Attached Files
.jpg
tmp-cam-1616005694.jpg
Size: 138.49 KB / Downloads: 25
hovatek
hovatek
hovatek
Administrator
49,570
07-11-2021, 07:51 AM
#3
(06-11-2021, 11:06 PM)babttech pls help I followed all the the steps but when format all and download it move to next partition.... like it started with vbmeta_system signed then I appended it to the up partition then it changed to vbmeta_vendor signed and I did the the same process it become 3partition in one I tried flash with sptool then I see super -verified. Img(error status_sec_img_too_large(0xC0020005)
Please what can i do

Can't see anything in that screenshot.
Share your scatter files before and after your modification

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
babttech
babttech
babttech
Junior Member
15
07-11-2021, 09:33 AM
#4
OK... This is the scatter files the one I downloaded from ur webpage and after editing it....the image is the last message I got after have appended vbmeta_system&vbmeta_vendor into vbmeta.... No pgpt in the firmware so I extracted from device with miracle cracked....please help me out after I format+download it now saying red state.... Thanks
This post was last modified: 07-11-2021, 09:38 PM by babttech.
Attached Files
.jpg
tmp-cam-1592644596.jpg
Size: 833.68 KB / Downloads: 37
.txt
MT6765_Android_scatter downloaded.txt
Size: 17.23 KB / Downloads: 59
.txt
MT6765_Android_scatter edited.txt
Size: 16.84 KB / Downloads: 45
babttech
babttech
babttech
Junior Member
15
09-11-2021, 01:24 AM
#5



Please reply me... Please
82clone
82clone
82clone
Newbie
2
24-04-2022, 12:02 PM
#6
have this one vivo y1s smatphone was write in wrong firmware vivo y91c and after use bypass tool fo rewrite it. but 3 position to dont wrine as Confusedervival , cust , vgc. and whow patch it ? The manual only lists one module. but i have 3
hovatek
hovatek
hovatek
Administrator
49,570
25-04-2022, 10:20 AM
#7
(24-04-2022, 12:02 PM)82clone have this one vivo y1s  smatphone  was write in wrong  firmware vivo y91c  and  after  use bypass  tool fo rewrite it. but 3 position to dont  wrine as Confusedervival , cust , vgc. and whow patch it ?  The manual only lists one module. but i have 3

Create a thread for this by clicking Ask Question at the top

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
82clone
82clone
82clone
Newbie
2
25-04-2022, 12:05 PM
#8
who have this one : vivo y1s please post full dump (sp flash tool ) fo me get it.
andongapo
andongapo
andongapo
Newbie
3
31-03-2023, 01:57 AM
#9
In step number 18, my file is larger because i append. But this cause me error that says, "checksum mismatch..." How do I solve this? (thanks very much)
hovatek
hovatek
hovatek
Administrator
49,570
06-04-2023, 09:56 AM
#10



(31-03-2023, 01:57 AM)andongapo In step number 18, my file is larger because i append. But this cause me error that says, "checksum mismatch..." How do I solve this? (thanks very much)

Create a thread by clicking Ask Question at the top

Note!
We have a reply schedule for Free Support. Please upgrade to Private Support if you can't wait.
Pages (2): 1 2 Next
Users browsing this thread:
 2 Guest(s)
Users browsing this thread:
 2 Guest(s)
YtWhTl
live chat
whatsapp telegram instagram